Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2695 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-11991 1 Apache 1 Cocoon 2024-11-21 7.5 High
When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
CVE-2020-11885 1 Wso2 1 Enterprise Integrator 2024-11-21 7.2 High
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
CVE-2020-11795 1 Jetbrains 1 Space 2024-11-21 7.5 High
In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.
CVE-2020-11688 1 Jetbrains 1 Teamcity 2024-11-21 7.5 High
In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
CVE-2020-11653 5 Debian, Opensuse, Redhat and 2 more 6 Debian Linux, Backports Sle, Leap and 3 more 2024-11-21 7.5 High
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.
CVE-2020-11586 1 Cipplanner 1 Cipace 2024-11-21 9.8 Critical
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
CVE-2020-11541 1 Techsmith 1 Snagit 2024-11-21 5.5 Medium
In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the local Administrator account.
CVE-2020-11296 1 Qualcomm 1064 Apq8009, Apq8009 Firmware, Apq8017 and 1061 more 2024-11-21 7.5 High
Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVE-2020-11280 1 Qualcomm 824 Aqt1000, Aqt1000 Firmware, Ar7420 and 821 more 2024-11-21 7.5 High
Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVE-2020-11278 1 Qualcomm 754 Aqt1000, Aqt1000 Firmware, Ar8031 and 751 more 2024-11-21 7.5 High
Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVE-2020-11274 1 Qualcomm 492 Aqt1000, Aqt1000 Firmware, Csrb31024 and 489 more 2024-11-21 7.5 High
Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2020-11218 1 Qualcomm 548 Apq8017, Apq8017 Firmware, Apq8053 and 545 more 2024-11-21 7.5 High
Denial of service in baseband when NW configures LTE betaOffset-RI-Index due to lack of data validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVE-2020-11135 1 Qualcomm 54 Apq8098, Apq8098 Firmware, Kamorta and 51 more 2024-11-21 7.5 High
u'Reachable assertion when wrong data size is returned by parser for ape clips' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8098, Kamorta, MSM8917, MSM8953, Nicobar, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVE-2020-10993 1 Osmand 1 Osmand 2024-11-21 9.1 Critical
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
CVE-2020-10992 1 Azkaban Project 1 Azkaban 2024-11-21 9.8 Critical
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
CVE-2020-10991 1 Mulesoft 1 Aplkit 2024-11-21 9.8 Critical
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
CVE-2020-10990 1 Accenture 1 Mercury 2024-11-21 9.8 Critical
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
CVE-2020-10876 2 Mica, Oklok Project 2 Fingerprint Bluetooth Padlock Fb50, Oklok 2024-11-21 7.5 High
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.
CVE-2020-10799 1 Svglib Project 1 Svglib 2024-11-21 9.8 Critical
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
CVE-2020-10761 4 Canonical, Opensuse, Qemu and 1 more 5 Ubuntu Linux, Leap, Qemu and 2 more 2024-11-21 5 Medium
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.